REMARKS 



Claims 1-35 are pending in the present application and were examined. Claims 1-6, 8-1 1, 
13-20, 22-27 and 29-35 stand rejected and Claims 7, 12, 21 and 28 are objected to. In response, 
Claims 1-5, 7, 11-13, 15-29 and 33 are amended, no claims are cancelled and no claims are added. 
Applicants respectfully request reconsideration of pending Claims 1-35 in view of at least the 
following remarks. Reconsideration and withdrawal of the rejections of record are requested in 
view of such amendments and the following discussion. 

I. Objection to the Drawing s 

The Examiner has objected to FIG. 14, block 656, as being incorrectly labeled as 
"UPSTREAM DEVICE ADDRESS." Applicants have amended FIG. 14, block 656, to state - 
DOWNSTREAM DEVICE ADDRESS." Replacement Sheet for FIG. 14 is attached hereto. 

IL Claim Objections 

The Examiner has rejected Claims 2, 20 and 27 due to various informalities. 

Regarding claim 2, Claim 2 has been amended such that the preamble now recites wherein 
receiving notification of the DDoS attack further comprises. 

Regarding claims 20 and 27, Claims 20 and 27 have been amended to recite "the received 
routing protocol update" as suggested by the Examiner. Accordingly, in view of the Applicants' 
amendments to claims 2, 20 and 27, Applicants respectfully request the Examiner reconsider and 
withdraw the objections to claims 2, 20 and 27. 

ffl. Claims Rejected Under 35 U.S.C. §112 

The Examiner has rejected Claims 4, 13, 21 and 28-29 under 35 U.S.C. §112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject 
matter which Applicants regard as the invention. 

Regarding claim 4, Claim 4 has been amended to indicate that the one or more filters are 
signed using a digital signature of the Internet host and that the filters are transmitted to the 
upstream router including a digital certificate of the Internet host. 

Regarding claims 13 and 29, Claims 13 and 29 are amended to recite the following claim 
features: 

comparing the selected destination address component 
against a routing table; 

verifying that the downstream router is a next hop router 
according to the routing table. 
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Support for Applicants' amendment to claims 13 and 29 is provided at paragraphs 0052- 
0053 and 0080 of Applicants' specification. 

Regarding claims 21 and 28: Claims 21 and 28 have been amended as requested by the 
Examiner. Accordingly, Applicants respectfully submit that claims 4, 13, 21 and 28-29 now 
particularly point out distinctly from the subject matter which Applicants regard as the invention. 
Accordingly, Applicants respectfully request the Examiner to reconsider and withdraw the 35 
U.S.C. §1 12, second paragraph objection of claims 4, 13, 21 and 28-29. . 



IV. Claims Rejected Under 35 U.S.C. §103 

The Examiner rejects Claims 1-6, 8-10, 15-20, 22-27 and 29-35 under 35 U.S.C. §103(a) as 
being unpatentable over Smith, et al., "A Protocol and Simulation for Distributed Communicating 
Firewalls (" Smith" ) in view of Shyne et al., "Using Active Networking to Thwart Distributed 
Denial of Service Attacks" (" Shyne" ). Applicants respectfully traverse this rejection. 

To establish a prima facie case of obviousness, the following criteria must be met: (1) there 
must be some suggestion or motivation to modify the reference or combine the reference teachings, 
(2) there must be a reasonable expectation of success, and (3) the prior art references must teach or 
suggest all the claim limitations. (MPEP §2142) 

Regarding claims 1 and 15: Claims 1 and 15 are amended to recite the following claim 
features which are neither taught or suggested by either Smith or Shyne for the references of 
record: 

receiving, by an Internet host , notification of a distributed 
denial of service (DDoS) attack : 

. . .; and 

once security authentication is established, transmitting one 
or more filters to the upstream router such that attack traffic is 
dropped by the upstream router to terminate the DDoS attack, 
wherein the upstream router includes a preprogrammed DDoS 
squelch time to live value to define an expiration time for the one or 
more filters. 

Regarding the Examiner's citing of Smith , Smith teaches a communicating gateway firewall 
(CGFW) where protocol, one of a LAN firewall or a CGFW node can initiate the protocol with 
another CGFW node on behalf of the originator (see page 77, left column, third paragraph). 
Applicants respectfully submit that Smith fails to teach. notification received an Internet host of a 
DDoS attack. As a result, the Examiner cites Shyne to teach detection of the DDoS attack. 

After a careful review of the entire specifications of both Smith and Shyne , Applicants are 
unable to identify a teaching or suggestion with regards to a DDoS squelch time to live value within 
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the upstream router to define an expiration time for the one or more filters transmitted from the 
Internet host to the upstream router, as recited by amended claims 1 and 15. Accordingly, 
Applicants respectfully submit that Applicants' amendments to claims 1 and 15 prohibit the 
Examiner from establishing a prima facie case of obviousness of claims 1 and 15 over the 
combination of Smith in view of Shyne, since the combination of references fail to teach or suggest 
each of the claim features recited by amended claims 1 and 15. 

Accordingly, claims 1 and 15, as amended, are patentable over the combination of Smith in 
view of Shyne , as well as the references of records. Consequently, Applicants respectfully request 
the Examiner to reconsider and withdraw the § 103(a) rejection of claims 1 and 15. 

Regarding claims 2-4, claims 2-4 based on the dependency from claim 1 also patentable 
over the combination of Smith in view of Shyne as well as the references of record. Consequently, 
Applicants respectfully request that the Examiner reconsider and withdraw the § 103(a) rejection of 
claims 2-4. 

Regarding the Examiner's rejection of claims 16-20 and 22-25, claims 16-20 and 22-25 
based on the dependency of claim 15 are also patentable over the combination of Smith in view of 
Shyne . Consequently, Applicants respectfully request the Examiner to reconsider and withdraw the 
§ 103(a) rejection of claims 16-20 and 22-25. 

Regarding the Examiner's rejection of claim 5, claim 5 is amended to recite the following 

claim feature which is neither taught or suggested by the combination of Smith in view of Shyne or 

the references of record: 

once verified, generating a filter expiration time for each filter 
based on a preprogrammed DDoS squelch time to live value , such 
that the filters are uninstalled once the expiration time expires . 

As indicated above with reference to the rejection of claims 1 and 15, the combination of 
Smith in view of Shyne fail to teach the above recited feature of amended claim 5. Accordingly, 
Applicants respectfully submit that Applicants' amendment to claim 5 prohibits the Examiner from 
establishing a prima facie case of obviousness of amended claim 5 over the combination of Smith 
in view of Shyne since the combination of Smith in view of Shyne fails to teach the above recited 
claim feature of amended claim 5. Consequently, Applicants respectfully request the Examiner 
reconsider or withdraw the §103(s) rejection of amended claim 5. 

Regarding claims 6 and 8-10, based on their dependency from claim 5, as amended, as also 
patentable over the combination of Smith in view of Shyne as well as the references of record. 
Consequently, Applicants respectfully request the Examiner reconsider and withdraw the § 103(a) 
rejection of claims 6 and 8-10. 
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Regarding claims 26 and 33, claims 26 and 33 are amended to recite the following claim 

feature which is neither taught or suggested by the combination of Smith in view of Shyne as well 

as the references of record: 

once verified, generate a filter expiration time for each filter 
based on a preprogrammed DDoS squelch time to live value, such 
that filters are uninstalled once the expiration time expires. 

For at least the reason described above, Applicants respectfully submit that Applicants' 
amendment to claims 26 and 33 to include the above recited claim feature prohibits the Examiner 
from establishing a prima facie case of obviousness of claims 26 and 33 over the combination of 
Smith in view of Shyne . Consequently, Applicants respectfully request that the Examiner 
reconsider and withdraw the § 103(a) rejection of claims 26 and 33. 

Regarding claims 27 and 29-32, claims 27 and 29-32 based on their dependency from claim 
26 are patentable over the combination of Smith in view of Shyne . Consequently, Applicants 
respectfully request the Examiner reconsider and withdraw the § 103(a) rejection of claims 27 and 
29-32. 

Regarding claims 34 and 35, claims 34 and 35 based on their dependency from amended 
claim 33 are also patentable over the combination of Smith in view of Shyne . Consequently, 
Applicants respectfully request that the Examiner reconsider and withdraw the § 103(a) rejection of 
claims 27 and 28. 

The Examiner rejects Claims 11 and 13-14 under 35 U.S.C. §103(a) as being unpatentable 
over Smith in view of U.S. Patent No. 6,425,004 issued to Hardjono (" Hardjono "). Applicants 
respectfully traverse this rejection. 

Regarding claim 11, claim 1 1 is amended to recite the following claim feature which neither 
taught or suggested by the combination of Smith in view of Hardjono as well as the references of 
record: 

once verified, generating a filter expiration time for each filter 
based on a preprogrammed DDoS squelch time to live value , such 
that the filters are uninstalled once the expiration time expires . 

Regarding the Examiner's citing of Hardjono , Hardjono fails to provide any teachings or 
suggestions with regards to the generation of a filter expiration time according to a DDoS squelch 
time to live value which is programmed by an administrator for received filters. Hence, for at least 
the reason as described above, Applicants respectfully submit that Applicants' amendment to claim 
1 1 prohibits the Examiner from establishing a prima facie case of amended claim 1 1 over Smith in 
view of Hardjono as well as the references of record. Consequently, Applicants respectfully request 
that the Examiner reconsider and withdraw the § 103(a) rejection of amended claim 11. 

Regarding claims 13 and 14, claims 13 and 14 based on their dependency from claim 1 1 are 
also patentable over the combination of Smith in view of Hardjono . Consequently, Applicants 
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respectfully request that the Examiner reconsider and withdraw the § 103(a) rejection of claims 13 
and 14. 

V. Allowable Subject Matter 

The Examiner has objected to Claims 7, 12, 21 and 28 are being dependent upon a rejected 
base claim. Applicants respectfully thank the Examiner for recognizing the allowability of Claims 
7, 12, 21 and 28. However, such claims are also allowable based on their dependency from 
amended Claims 5, 11, 19 and 26, respectively. 



In view of the foregoing, it is submitted that Claims 1-35, as amended, patentably define the 
subject invention over the cited references of record, and are in condition for allowance and such 
action is earnestly solicited at the earliest possible date. If the Examiner believes a telephone 
conference would be useful in moving the case forward, he is encouraged to contact the 
undersigned at (310) 207-3800. 

If necessary, the Commissioner is hereby authorized in this, concurrent and future replies, to 
charge payment or credit any overpayment to Deposit Account No. 02-2666 for any additional fees 
required under 37 C.F.R. §§L16 or 1.17, particularly, extension of time fees. 



CONCLUSION 



Respectfully submitted, 

BLAKELY, SOKOLOFF, TAYLOR, & ZAFMAN LLP 



Dated: December 2 L 2004 




12400 Wilshire Boulevard 
Seventh Floor 

Los Angeles, California 90025 
(310) 207-3800 



I hereby certify that this correspondence is being deposited with the 
United States Postal Service on the date shown below with sufficient 
postage as first class mail in an envelope addressed to: Commissioner 
for Patents, P.O. Box 1450, Alexandria, VA 22313-1450. 
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